CVE-2026-108726: GLPI Authorization Bypass Vulnerability

CVE-2026-108726 Overview

CVE-2026-108726 is a missing authorization vulnerability [CWE-862] affecting GLPI through version 12.0.0. The flaw resides in ajax/map.php, which fails to invoke the canView() check before processing itemtype search requests. Authenticated low-privileged users can submit crafted itemtype and search criteria to enumerate records they are not authorized to view. Affected itemtypes include Contact, Supplier, Contract, and Budget. Successful exploitation returns match counts, titles, and geographic coordinates scoped to the attacker's entities. The issue was published to NVD on 2026-10-11 and last modified on 2026-10-13.

Critical Impact

Authenticated users with minimal privileges can harvest business-sensitive records (suppliers, contracts, budgets, contacts) that should be gated by role-based access controls.

Affected Products

• GLPI versions up to and including 12.0.0
• GLPI ajax/map.php endpoint
• Deployments exposing GLPI to authenticated low-privileged users

Discovery Timeline

• 2026-10-11 - CVE-2026-108726 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108726

Vulnerability Analysis

GLPI is an open-source IT asset and service management platform. The ajax/map.php endpoint renders map-based views of itemtypes that carry location data. The handler accepts an itemtype parameter and corresponding search criteria from the client, then queries the database for matching entries within the user's entity scope. The handler omits the standard canView() authorization check that other GLPI endpoints apply before returning data for a given itemtype. As a result, the server enforces entity boundaries but not per-itemtype role permissions. Authenticated users who lack read access to assets such as Supplier or Budget still receive match counts, record titles, and coordinates. Full details are available in the HackMD analysis and the VulnCheck security advisory.

Root Cause

The root cause is a missing authorization check in the request handler. GLPI relies on the per-itemtype canView() method to confirm the current session holds the right profile permissions. The ajax/map.php code path proceeds directly to search execution without this gate. See the vulnerable region of the handler in the GLPI source on GitHub.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An authenticated attacker sends a POST request to ajax/map.php with an itemtype such as Contact, Supplier, Contract, or Budget and an accompanying search payload. The server responds with match counts, titles, and coordinates for records within the attacker's entity. No synthetic exploit code is reproduced here; refer to the VulnCheck advisory for request details.

Detection Methods for CVE-2026-108726

Indicators of Compromise

• Repeated POST requests to /ajax/map.php from a single authenticated session containing varied itemtype values
• Requests referencing itemtype=Supplier, itemtype=Contract, itemtype=Budget, or itemtype=Contact from accounts that lack read access to those modules
• Elevated response sizes from ajax/map.php for low-privileged users

Detection Strategies

• Review GLPI web server access logs for ajax/map.php requests correlated to user profiles without matching itemtype permissions
• Compare itemtype parameter values against the authenticated user's profile rights in GLPI
• Alert on bursts of ajax/map.php requests that iterate across multiple itemtypes within a short window

Monitoring Recommendations

• Enable GLPI audit logging and forward web server logs to a centralized analytics platform for query-based detection
• Baseline normal usage of ajax/map.php per user role and flag deviations
• Monitor for anomalous enumeration patterns from service accounts or newly provisioned low-privileged accounts

How to Mitigate CVE-2026-108726

Immediate Actions Required

• Inventory GLPI deployments and identify instances running version 12.0.0 or earlier
• Restrict access to the GLPI interface to trusted networks or VPN segments where feasible
• Review account provisioning to minimize the number of low-privileged users with authenticated access

Patch Information

At the time of publication, consult the GLPI project repository for the latest release that enforces canView() within ajax/map.php. Upgrade all GLPI instances to the fixed version once available and verify the patch by inspecting the ajax/map.php handler for an itemtype authorization check.

Workarounds

• Apply web server access control lists (ACLs) or WAF rules that block requests to /ajax/map.php with itemtype values corresponding to sensitive modules such as Supplier, Contract, and Budget
• Disable map features for user profiles that do not require them
• Audit GLPI profile configurations and remove unnecessary read grants that could amplify exposure

# Example nginx rule to block ajax/map.php requests for sensitive itemtypes
location = /ajax/map.php {
    if ($request_body ~* "itemtype=(Supplier|Contract|Budget|Contact)") {
        return 403;
    }
    proxy_pass http://glpi_backend;
}